diff --git a/lib/migrator/helpers.ts b/lib/migrator/helpers.ts
index 95539124..509d233d 100644
--- a/lib/migrator/helpers.ts
+++ b/lib/migrator/helpers.ts
@@ -200,28 +200,53 @@ export const getTargetBlockDevice = async (mountLabel: string = 'C') => {
 	})
 }
 
+/** 
+ * Identifies the type of WiFi authentication for a connection profile.
+ * NONE means no authentication.
+ */
+export const enum WifiAuthType { NONE, WPA2_PSK, WPA3_SAE }
+
 /** Configuration values for a single WiFi network profile. */
 export interface ConnectionProfile {
 	name: string;
 	wifiSsid: string;
+	wifiAuthType: WifiAuthType;
 	wifiKey: string;
 }
 
 /** Generates the contents for a balenaOS network configuration file. */
 const generateWifiConfig = (profile: ConnectionProfile): string => {
-	return `[connection]
+	const connectionSection = `[connection]
 id=${profile.name}
 type=wifi
-
+`
+	const wifiSection = `
 [wifi]
 mode=infrastructure
 ssid=${profile.wifiSsid}
-
+`
+	let keyMgmt
+	switch (profile.wifiAuthType) {
+		case WifiAuthType.NONE:
+			keyMgmt = 'none'
+			break
+		case WifiAuthType.WPA2_PSK:
+			keyMgmt = 'wpa-psk'
+			break
+		case WifiAuthType.WPA3_SAE:
+			keyMgmt = 'sae'
+			throw Error("WifiAuthType WPA3_SAE not supported")
+		default:
+			throw Error(`WifiAuthType ${profile.wifiAuthType} not defined`)
+	}
+		const wifiSecuritySection = `
 [wifi-security]
 auth-alg=open
-key-mgmt=wpa-psk
+key-mgmt=${keyMgmt}
 psk=${profile.wifiKey}
+`
 
+	const ipSection = `
 [ipv4]
 method=auto
 
@@ -229,6 +254,8 @@ method=auto
 addr-gen-mode=stable-privacy
 method=auto
 `
+
+	return connectionSection.concat(wifiSection, wifiSecuritySection, ipSection)
 }
 
 /**
diff --git a/lib/migrator/index.ts b/lib/migrator/index.ts
index 5162fa6d..d41a2ac4 100644
--- a/lib/migrator/index.ts
+++ b/lib/migrator/index.ts
@@ -11,6 +11,7 @@ import {
 	findNewPartitions,
 	findFilesystemLabel,
 	ConnectionProfile,
+	WifiAuthType,
 	writeNetworkConfig
 } from './helpers';
 import { copyBootloaderFromImage } from './copy-bootloader';
@@ -22,6 +23,9 @@ const execAsync = promisify(childExec);
 import { constants as osConstants } from 'os';
 import { existsSync } from 'fs'
 
+// Callers need to provide profiles via options
+export { ConnectionProfile, WifiAuthType }
+
 /** Determine if running as administrator. */
 async function isElevated(): Promise<boolean> {
     // `fltmc` is available on WinPE, XP, Vista, 7, 8, and 10
@@ -282,6 +286,9 @@ export const migrate = async (
 					await writeNetworkConfig(pathname, profile)
 					console.log(`Wrote network configuration for ${profile.name}`)
 				}
+				if (!options.connectionProfiles.length) {
+					console.log("No network configuration provided")
+				}
 			} finally {
 				await diskpart.clearDriveLetter(bootPartition.volumeId, driveLetter)
 			}